Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
Pre-existing issues: - [High] Mixing devm_kzalloc for DRM objects (like planes and CRTCs) with drmm_mode_config_init causes a guaranteed Use-After-Free during driver unbind or probe failure. -- commit 6e5820173d0237a07dd104b640171197be436f49 Author: Qingshuang Fu <[email protected]> drm/logicvc: fix device_node refcount leak in logicvc_layers_init() This commit fixes a device node reference leak in logicvc_layers_init(). It adds a missing of_node_put() on the error path to ensure the reference acquired by for_each_child_of_node() is properly released when logicvc_layer_init() fails. > diff --git a/drivers/gpu/drm/logicvc/logicvc_layer.c > b/drivers/gpu/drm/logicvc/logicvc_layer.c > index 7f5ba000188ab..e83a2aafed779 100644 > --- a/drivers/gpu/drm/logicvc/logicvc_layer.c > +++ b/drivers/gpu/drm/logicvc/logicvc_layer.c > @@ -613,6 +613,7 @@ int logicvc_layers_init(struct logicvc_drm *logicvc) > > ret = logicvc_layer_init(logicvc, layer_node, index); > if (ret) { > + of_node_put(layer_node); > of_node_put(layers_node); > goto error; [Severity: High] This isn't a bug introduced by this patch, but could this error path lead to a use-after-free during mode config cleanup? When logicvc_layer_init() fails and the code jumps to the error label, logicvc_layers_init() cleans up previously initialized layers by calling logicvc_layer_fini(). This function calls devm_kfree(dev, layer) without first calling drm_plane_cleanup(), leaving dangling pointers in the drm_dev plane_list. Additionally, because logicvc_drm_probe() sets up mode config via drmm_mode_config_init(), the mode config cleanup is registered as a DRM managed action. The layer and CRTC structures are allocated with devres (devm_kzalloc() in logicvc_layer_init() and logicvc_crtc_init()). During a probe failure or driver unbind, devres runs in LIFO order and frees the layers and CRTC before releasing the drm_dev. When the drm_dev is finally released, drmm_mode_config_cleanup() iterates over mode_config.plane_list and crtc_list to call their destroy hooks, dereferencing the already freed memory. > } > -- Sashiko AI review ยท https://sashiko.dev/#/patchset/[email protected]?part=1
